fix: unblock openapi code generation - #2653
Open
tsand wants to merge 7 commits into
Open
Conversation
The 401/403 responses of DELETE /user/identities/{identityId} pointed
`schema` at Response Objects, which strict parsers reject ("expecting
ref to schema object"), breaking `go generate` on a clean checkout.
Both components wrap ErrorSchema; the sibling 404 already references it.
The oneOf arms are inline schemas, so `propertyName: type` has no schema name to resolve to and the discriminator never applied. Generators fail with "discriminator: not all schemas were mapped". Each arm keeps its `type` enum, so clients can still branch on create vs request.
IdentitySchema.id serializes models.Identity.ProviderID, the subject issued by the external provider, not a UUID. Only the email and phone providers use the user's ID there. Strict UUID parsing in generated clients fails to deserialize identities from other providers.
UserUpdateParams accepts it, and the handler requires it when Security.UpdatePasswordRequireCurrentPassword is enabled.
The endpoint is routed to adminUserCreate and documented in the README, but was missing from the spec. AdminCreateUserSchema mirrors AdminUserParams: UserSchema describes a response and cannot express password, password_hash, email_confirm, phone_confirm or ban_duration, so a client generated against it could not exercise the endpoint.
tsand
force-pushed
the
fix/openapi-spec-defects
branch
from
July 28, 2026 13:51
7de116d to
473cec4
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What kind of change does this PR introduce?
Bug fix and docs update. Spec-only, no code changes.
What is the current behavior?
openapi.yamlhas not loaded in kin-openapi since February 2025, sogo generate ./...fails on a clean checkout. Both the pinned generator (v2.4.2) and the current release (v2.8.0) reject it identically, so upgrading doesn't help.The blocker is the unlink identity 401/403 responses, which reference Response Objects where a schema belongs. kin-openapi rejects the whole document over it.
Three smaller problems: the WebAuthn challenge discriminator points at inline oneOf arms so it can never resolve; identity id is marked as a UUID when it's really the provider's subject; and current_password on PUT /user plus POST /admin/users are undocumented.
What is the new behavior?
GOTRUE_SECURITY_UPDATE_PASSWORD_REQUIRE_CURRENT_PASSWORDis on and the user already has a password. Not enforced during recovery.Additional context
Warning
Identity id becomes a string, so identity.Id.String() breaks the next time the admin client is regenerated. The UUID is still available on identity_id.
I left
client/adminalone. It's 13 spec commits stale, so regenerating emits about 3,800 lines of unrelated code, plus roughly 2,900 more if the unpinned generator drifts to v2.8.0. Happy to do that separately. The first commit here unblocks it.Verified by generating the admin client with both v2.4.2 and v2.8.0: both succeed on this branch, both fail on master. No tests added, make test not run.